Information Management Assessment

Action plan progress report

Home Office

Reviewed February 2017

Published July 2017

Working with government to raise standards in information management Background The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The Home Office IMA took place in 2015. This progress report summarises key developments since the IMA. Areas where attention is still needed are listed below under ‘Next Steps.’

Action plan development A statement by then Permanent Secretary, Mark Sedwill, was published alongside the IMA report in May 2016.¹ This highlighted the department’s intention to improve performance under the four development areas identified by our assessment.

An action plan was produced under the ownership of the Knowledge and Information Management (KIM) team and Departmental Records Officer (DRO). We are pleased to note that work to progress a number of key action points received support from the Senior Information Risk Owner (SIRO).

The IMA team was also invited to a meeting of the department’s newly formed Knowledge and Information Executive Group (KIEG) to discuss findings and next steps in January 2016. The IMA team will attend a further meeting in summer 2017.

¹ http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/ Progress to address recommendations and risk areas

1 The value of information

| Performance rating | IMA 2015 | Review 2017 | |--------------------|----------|-------------| | Communicating and realising value | Satisfactory | Satisfactory | | Managing information as an asset | Development area | Satisfactory |

Situation at the time of the IMA

Home Office had recognised the need to improve standards of paper records keeping following publication of the 2014 review by Peter Wanless and Richard Whittam QC. The department had also identified gaps in relation to current practice and areas for improvement that had been communicated to the Executive Management Board and Permanent Secretary. However, there was no single, endorsed, time bound plan in place to drive necessary work across the organisation or communicate to staff why this mattered.

A programme of work to improve oversight of the department’s information assets had been carried out, but significant gaps were still evident at the time of the IMA.

Home Office has produced a principle-led and format-neutral information strategy that has been promoted internally. It is intended to help drive better culture as well as better IT provision. A promotional news story on the intranet at the time of publication was used to point staff to existing guidance and provide a reminder to participate in responsible for information training. It also provided a push for the department’s new knowledge and information management e-learning package (see p. 6).

The strategy is scheduled to run through to 2019 and focuses on the themes of information assurance, information availability and information exploitation. It provides a summary of current practice and internal and cross-government drivers as well as setting out the benefits of improving standards. This represents a significant step forward for Home Office. However, while the strategy has been surfaced at Permanent Secretary and SIRO level, it currently lacks visible senior endorsement. While some key priorities are being delivered through annual work plans, no formal implementation plan has been developed. These points need to be addressed to maintain the satisfactory rating under this heading. Although there is an intention to ensure alignment with Home Office’s Transformation and Excellence and Data Strategies, information strategy goals do not appear to have been adopted by the organisation as a whole.

Guidance and policy documentation relating to information assets is not yet fully consistent, but Home Office’s Information Asset Register and governance processes for information assets have already been substantially overhauled since the IMA. The Knowledge and Information Management Unit (KIMU) undertook a project to engage with business areas and ascertain what information assets were held according to clearly defined criteria, focussing on volume, criticality and sensitivity. Retention and disposal of information assets is now within scope. Home Office has also standardised the role of Information Asset Owner (IAO), which now has to be held at a minimum of Civil Service Senior Executive Officer level. The National Archives ran its Delivering IA Training course in November 2016 for members of Home Office’s KIM and Security teams. The department is now developing its own IAO training programme.

2 Digital information and supporting technology

| Performance rating | IMA 2015 | Review 2017 | |-------------------------------------|----------------|----------------------| | Supporting information through technology | Development area | Progressing to Satisfactory | | Digital continuity and IT change | Development area | Development area |

Situation at the time of the IMA

Although Home Office’s Corporate File Plan met key records management requirements, staff were not using it consistently and it was not available to the whole department. Unstructured shared drives and SharePoint 2007 were in use in some areas. No size limits were in place on email accounts and large volumes of information was held outside shared spaces in mailboxes and personal drives. Home Office had begun rolling out an interim SharePoint 2010 based solution, iManage, to address the risks raised by its IT environment ahead of wider technology change and planned moves to Office 365. While we were pleased to note that Home Office recognised the need for third-party plug-ins to enable email integration and increased records management functionality in SharePoint 2010, it also needed to consider limiting alternative storage locations.

Home Office had not embedded digital continuity related considerations in KIM planning or defined the risks it faced.

iManage has now been fully rolled out. Limitations imposed by the configuration of Home Office’s IT network have resulted in some potential barriers regarding the uptake of the system. These include the need for an additional login and the fact that users are directed to their personal drives when saving documents. The Corporate File Plan has been closed off and the contents have been made read-only.

Home Office has not yet identified fully how it will ensure the digital continuity of its information. We recognise, however, that information availability is one of the pillars of its new information strategy and that goals under this heading cover both current and legacy information. Home Office has committed to assessing and addressing the risks it faces and intends to develop a formal strategy to deal with the issue of aging data and file formats. It plans to use its e-Discovery software to understand the scale of the issue it faces and then agree an approach.

No decisions have yet been reached on capping or imposing limits on personal repositories within the Office 365 environment, including email and OneDrive, although such consideration are within scope of planned work. At the time of our review meeting it was not clear whether SharePoint Online would still form part of the department’s Office 365 roll-out. It has since been confirmed that the platform remains within scope. Home Office now needs to ensure that its legislative and business requirements for information and records management are met through the adoption of its new IT environment. It is considering use of third-party plug-ins to enable email integration with SharePoint Online, but is not intending to use them to increase functionality in areas such as retention and disposal, export and audit. Home Office needs to define how any potential gaps in these areas will be addressed. To ensure current progress can be maintained, Home Office’s IT plans must be aligned and in-step with the information availability goals set by the information strategy.

3 Information risk, governance and oversight

| Performance rating | IMA 2015 | Review 2017 | |-----------------------------|----------------|-------------| | Recognising information risk| Satisfactory | Satisfactory| | Establishing control | Development area| Satisfactory| | Providing guidance | Satisfactory | Good practice| | Measuring impact | Good practice | Good practice|

Situation at the time of the IMA

Home Office had one of the most mature understandings of information management-related risk that we had encountered. Cultural factors that might lead to non-compliance with policy still needed to be recognised at a local level. The Chief Operating Officer and SIRO had supported and enabled the team’s promotion of information management priorities at board level. We were also pleased to note that information and records management had been subject to scrutiny from internal audit.

A Knowledge and Information Executive Group (KIEG) had been set up, badged as a senior-level forum for considering and deciding knowledge and information issues. This body had significant potential, but had not yet bedded in. The KIMU team was working with a clear purpose, but its remit did not cover the whole department, which lacked a single coherent governance framework for enabling and improving knowledge and information management performance.

A range of guidance was available, but gaps were evident and staff awareness was low in some areas. However, the department had recognised the need to ensure staff understood what information they needed to keep and how it should be managed. It also had an active approach to assessing capability in information management and information assurance using its integrated One3M maturity model.

The risk that Home Office may fail to find key information is currently logged on the Information Rights risk register. At the time of our review meeting, the potential consequences for the department and impact on departmental objectives of a failure to implement the planned EDRM solution was also clearly set out. While we saw no evidence that risks related to compliance with information management policy were being formally defined locally and owned by business area, Home Office has used the KIEG to engage senior managers on the subject. There is a standing agenda item on information management risk.

Home Office now has a unified governance structure for information and records management. The Information Management and Compliance Unit was absorbed into KIMU following the IMA. Quarterly meetings are now held with KIM staff in the Office for Security and Counter Terrorism. The KIEG is acting as a forum for the communication of key priorities and for reviewing and initiating planned work. KIEG agreed the department’s KIM Service Level Agreement for 2016/17 and owns the information strategy. KIEG members, in their capacity as Knowledge and Information Champions, are expected to help realise the vision set out by KIEG in their own business areas. They have, for example, played a key role in ensuring the Information Asset Register was up to date.

Existing information management support roles in the business have been reviewed and standardised. Records Advisers have been replaced by KIM Advisers. A suggested Key Performance Objective has been drafted. The role of KIM Manager has been introduced. Responsibilities include driving compliance with policy and acting as a focal point of contact and escalation point to the KIEG. We were pleased to note that Border Force now has its own KIM community that holds monthly information management forums with senior sponsorship.

KIM policy and guidance has been reviewed and presented to the KIEG in November 2015. Home Office has mapped policy and guidance, identifying owners and logging review dates. It is working to consolidate and standardise guidance, including documentation inherited through machinery of government change. Retention schedules have been reviewed and simplified and Home Office is working to apply consistent standards to all areas of the business. What-to-keep guidance published on GOV.UK immediately prior to the IMA has been updated as this work has progressed.²

A plan has been established for the dissemination of KIM principles and priorities to staff via a range of channels, including delivery of its KIM professionalism plan. Links between the KIM professionalism plan and civil service reform goals for a more skilled workforce have been defined. Additional channels include the department’s new internal e-learning package. All staff – aside from those in front-line roles – were expected to complete the course by March 2017 and repeat it once every three years. The SIRO played a key role in promoting the course at board level and messaging was reinforced through the KIEG.

Home Office’s One3M maturity model has continued to develop and evolve, enabling a new focus on cyber security and on behavioural testing, which the department hopes will allow areas of weakness to be highlighted. It is currently assessing how the model could be mapped to information strategy goals in the future.

² https://www.gov.uk/government/publications/home-office-retention-and-disposal-standards#history 4 Records, review and transfer

| Performance rating | IMA 2015 | Review 2017 | |--------------------|----------|-------------| | Oversight of records and selection | Satisfactory | Progressing to good practice | | Implementing disposal decisions | Satisfactory | Satisfactory |

Situation at the time of the IMA

Home Office was working to improve the quality of data on its paper records tracking system RMSys, imposing standard data entries where the status of records was unclear. A review of paper holdings had been carried out in 2014 and Home Office had published retention schedules online in accordance with recommendations in Sir Alex Allan’s Records Review. It had begun work on developing an appraisal report.

Home Office had not yet mapped out how resource changes would impact on its ability to meet requirements for increased transfer volumes during the transition to the 20-year rule. Disposal of records was on hold due to the requirements of the Independent Inquiry into Child Sexual Abuse. However, Home Office had no ability to apply disposal to its shared drives and had no central oversight or control over their contents.

Home Office has a clearer understanding of its legacy in all formats. Its Records Transfer Report is submitted to the Permanent Secretary. This demonstrates the significance attached to meeting its obligations under the Public Records Act. Its appraisal report has been developed with input from The National Archives; Home Office expects this to be opened for public consultation shortly. It is exploring with The National Archives the use of macro appraisal approaches. A majority of errors identified in RMSys have been resolved. Home Office still plans to replace the system.

Home Office is working to index its shared drives using its e-Discovery tool and plans to liaise with The National Archives on search terms. It will then use the tool to identify information with potential historical value and treat the remainder as a wasting asset that will be placed under a blanket 15-year disposal schedule. Home Office is also undertaking an analysis of its digital records created prior to the end of its print-to-paper policy in 2005. It is hoping to use the tool to support sensitivity review of digital information; the process has been trialled for the transfer of records relating to the Litvinenko Inquiry. Next Steps

The National Archives will continue to work closely with Home Office so that it is supported as it continues its work on information and records management through to the time of its next IMA in 2019/20. In the interim, Home Office should work with The National Archives to address remaining actions that need attention. These include the following:

- Identifying a senior owner for the information strategy and providing an endorsement
- Establishing an implementation plan to ensure defined outcomes for the availability, exploitation and security will be achieved, including those to be delivered through IT change. Links between KIMU and digital, data and technology colleagues need to be embedded to support delivery of shared and overlapping goals
- Ensuring guidance and policy documentation relating to information asset governance is fully consistent
- Continuing to assess the benefits of putting controls in place to limit the ability of staff to store information outside shared areas. This is most likely to deliver benefit when accompanied by work to drive the right behaviours and encourage positive changes in information and records management culture
- Ensuring that the department fully defines how its legislative and business requirements for information and records management will be met within the Office 365 environment and how any gaps will be addressed. This should be reflected in risk descriptions. Without an appropriate technology solution, a significant burden may be placed on business areas and the central team
- Defining actions needed to ensure digital continuity is maintained in line with Home Office information strategy goals
- Defining the risk the department faces in terms of ensuring the usability of current and legacy digital information
- Continuing work to consolidate and standardise policy and guidance
- Implementing plans for disposal of legacy information
- Developing search terms for the e-Discovery work to identify information of potential historical value
- Utilise macro-appraisal methodologies to achieve compliance with the transition to the 20 year rule.